Home

Description

LogicalDOC Enterprise 7.7.4 contains multiple authenticated OS command execution vulnerabilities that allow attackers to manipulate binary paths when changing system settings. Attackers can exploit these vulnerabilities by modifying configuration parameters like antivirus.command, ocr.Tesseract.path, and other system paths to execute arbitrary system commands with elevated privileges.

PUBLISHED Reserved 2025-12-24 | Published 2025-12-24 | Updated 2025-12-24 | Assigner VulnCheck




HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
MEDIUM: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Problem types

Untrusted Search Path

Product status

7.7.4
affected

7.7.3
affected

7.7.2
affected

7.7.1
affected

7.6.4
affected

7.6.2
affected

7.5.1
affected

7.4.2
affected

7.1.1
affected

Credits

LiquidWorm as Gjoko Krstic of Zero Science Lab finder

References

www.exploit-db.com/exploits/44021 exploit

www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5452.php exploit

www.exploit-db.com/exploits/44021 (ExploitDB-44021) exploit

www.logicaldoc.com (Official Product Homepage) product

www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5452.php (Zero Science Lab Disclosure (ZSL-2018-5452)) third-party-advisory

cve.org (CVE-2019-25257)

nvd.nist.gov (CVE-2019-25257)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.